Bug 1609720

Summary: Starting VM without source configured for pci-serial device caused libvirtd crash
Product: Red Hat Enterprise Linux 7 Reporter: jiyan <jiyan>
Component: libvirtAssignee: Andrea Bolognani <abologna>
Status: CLOSED ERRATA QA Contact: yalzhang <yalzhang>
Severity: high Docs Contact:
Priority: medium    
Version: 7.6CC: dyuan, jdenemar, jiyan, lmen, tburke, xuzhang, yalzhang
Target Milestone: rc   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: libvirt-4.5.0-12.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1609723 (view as bug list) Environment:
Last Closed: 2019-08-06 13:13:56 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1609723    

Description jiyan 2018-07-30 09:02:54 UTC
Description:
Starting VM without source configured for serial device caused libvirtd crash

How reducible:
100%

Version:
kernel-3.10.0-927.el7.x86_64
libvirt-4.5.0-4.el7.x86_64
qemu-kvm-rhev-2.12.0-8.el7.x86_64

Steps:
1. Prepare a VM as the following shows
# virsh domstate vm1
shut off

# virsh dumpxml vm1 |grep "<serial" -A6
    <serial type='unix'>
      <target type='pci-serial' port='0'>
        <model name='pci-serial'/>
      </target>
      <alias name='ua-e5774d14-3276-48af-b02d-2299137f4b88'/>
      <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/>
    </serial>

2. Start VM and check the pid of libvirtd
# pidof libvirtd
31702

# virsh start vm1
error: Disconnected from qemu:///system due to end of file
error: Failed to start domain vm1
error: End of file while reading data: Input/output error

# pidof libvirtd
31884

Actual result:
As step-2 shows

Expected result:
Starting VM with wrong configuration should raise reasonable error info

Additional info:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f5497340700 (LWP 2521)]
__strlen_sse2_pminub () at ../sysdeps/x86_64/multiarch/strlen-sse2-pminub.S:38
38		movdqu	(%rdi), %xmm1

Comment 2 Jing Qi 2018-07-31 09:05:09 UTC
The source need to given for the "unix" type serial as below.

<serial type="unix"> 
 <source mode="bind" path="/var/lib/libvirt/qemu/foo"/> *****
 <target type='pci-serial' port='0'>  
 <model name='pci-serial'/>
</serial>

#virsh start avocado-vt-vm3
Domain avocado-vt-vm3 started

So, I think error message need to be printed when define or edit the domain xml.

Comment 3 Andrea Bolognani 2018-09-07 11:07:25 UTC
Patch posted upstream.

  https://www.redhat.com/archives/libvir-list/2018-September/msg00246.html

Comment 4 Andrea Bolognani 2018-09-07 15:20:55 UTC
Fix merged upstream.

  commit 614193fac67445a7e92bf620ffef726ed1bd6f07
  Author: Andrea Bolognani <abologna>
  Date:   Thu Sep 6 17:51:10 2018 +0200

    conf: Fix check for chardev source path
    
    Attempting to use a chardev definition like
    
      <serial type='unix'>
        <target type='isa-serial'/>
      </serial>
    
    correctly results in an error being reported, since the source
    path - a required piece of information - is missing; however,
    the very similar
    
      <serial type='unix'>
        <target type='pci-serial'/>
      </serial>
    
    was happily accepted by libvirt, only to result in libvirtd
    crashing as soon as the guest was started.
    
    The issue was caused by checking the chardev's targetType
    against whitelisted values from virDomainChrChannelTargetType
    without first checking the chardev's deviceType to make sure
    it is actually a channel, for which the check makes sense,
    rather than a different type of chardev.
    
    The only reason this wasn't spotted earlier is that the
    whitelisted values just so happen to correspond to USB and
    PCI serial devices and Xen and UML consoles respectively,
    all of which are fairly uncommon.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1609720
    
    Signed-off-by: Andrea Bolognani <abologna>
    Reviewed-by: Ján Tomko <jtomko>

v4.7.0-65-g614193fac6

Comment 8 yalzhang@redhat.com 2019-05-20 03:22:36 UTC
Reproduced on libvirt-4.5.0-10.el7_6.9.x86_64
# pidof libvirtd; virsh start rhel ; sleep 10;  pidof libvirtd
16291
error: Disconnected from qemu:///system due to end of file
error: Failed to start domain rhel
error: End of file while reading data: Input/output error

16773
test on libvirt-4.5.0-17.el7.x86_64, the result is as expected, set the bug as verified.
1. edit xml with unix type and isa-serial without source
# virsh edit rhel
<serial type='unix'>
        <target type='isa-serial'/>
      </serial>
error: internal error: Missing source path attribute for char device
Failed. Try again? [y,n,i,f,?]:
2. edit xml with unix type and pci-serial without source
# virsh edit rhel
<serial type='unix'>
        <target type='pci-serial'/>
      </serial>
error: internal error: Missing source path attribute for char device
Failed. Try again? [y,n,i,f,?]: 
3. start vm, then hotplug serail without source:
# cat serial.xml
<serial type='unix'>
        <target type='pci-serial'/>
      </serial>
# virsh start rhel
Domain rhel started
# virsh attach-device rhel console.xml
error: Failed to attach device from console.xml
error: internal error: Missing source path attribute for char device
4. clod plug
# virsh destroy rhel
Domain rhel destroyed
# virsh attach-device rhel serial.xml  --config
error: Failed to attach device from serial.xml
error: internal error: Missing source path attribute for char device

Comment 10 errata-xmlrpc 2019-08-06 13:13:56 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2294